flask: fix build after the introduction of DMOP

In 58cbc034 send_irq permission was removed but there was still
reference to it in policy file. Remove the stale reference.

And now we also need dm permission. Add that.

Signed-off-by: Wei Liu <wei.liu2@citrix.com>
Reviewed-by: Paul Durrant <paul.durrant@citrix.com>
xsm/build: Further build fixes following the DMop series

Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>

diff --git a/tools/flask/policy/modules/xen.if b/tools/flask/policy/modules/xen.if
index 45e5cea04f8f0b114dbabfd58f913ad1072ce206..f5d254f053e07d65dbc0bea34dbd3acbf9269cac 100644 (file)
--- a/tools/flask/policy/modules/xen.if
+++ b/tools/flask/policy/modules/xen.if
@@ -58,7 +58,7 @@ define(`create_domain_common', `
        allow $1 $2:mmu { map_read map_write adjust memorymap physmap pinpage mmuext_op updatemp };
        allow $1 $2:grant setup;
        allow $1 $2:hvm { cacheattr getparam hvmctl sethvmc
-                       setparam nested altp2mhvm altp2mhvm_op send_irq };
+                       setparam nested altp2mhvm altp2mhvm_op };
 ')
 
 # create_domain(priv, target)

diff --git a/xen/xsm/dummy.c b/xen/xsm/dummy.c
index 1f659c79de8aa884e18225b72bc98067b11c5afa..3cb5492dd354e712be56a213bc576d60e0d4d4fb 100644 (file)
--- a/xen/xsm/dummy.c
+++ b/xen/xsm/dummy.c
@@ -156,6 +156,7 @@ void __init xsm_fixup_ops (struct xsm_operations *ops)
     set_to_dummy_if_null(ops, ioport_permission);
     set_to_dummy_if_null(ops, ioport_mapping);
     set_to_dummy_if_null(ops, pmu_op);
+    set_to_dummy_if_null(ops, dm_op);
 #endif
     set_to_dummy_if_null(ops, xen_version);
 }

diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
index 9332ca1af8db7c5ae5c3ba802289fbe00d459d3c..4baed398900a32e97424a07f07b8d03932326162 100644 (file)
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -1776,9 +1776,6 @@ static struct xsm_operations flask_ops = {
 #ifdef CONFIG_X86
     .do_mca = flask_do_mca,
     .shadow_control = flask_shadow_control,
-    .hvm_set_pci_intx_level = flask_hvm_set_pci_intx_level,
-    .hvm_set_isa_irq_level = flask_hvm_set_isa_irq_level,
-    .hvm_set_pci_link_route = flask_hvm_set_pci_link_route,
     .mem_sharing_op = flask_mem_sharing_op,
     .apic = flask_apic,
     .machine_memory_map = flask_machine_memory_map,

diff --git a/xen/xsm/flask/policy/access_vectors b/xen/xsm/flask/policy/access_vectors
index 36a7df9394e7d09cd95fd28efdb5a1deb77b6a75..1f7eb35fc8eff3c7fb19ae2cf969683d4c3efa5c 100644 (file)
--- a/xen/xsm/flask/policy/access_vectors
+++ b/xen/xsm/flask/policy/access_vectors
@@ -284,6 +284,8 @@ class hvm
 # HVMOP_altp2m_destroy_p2m HVMOP_altp2m_switch_p2m
 # HVMOP_altp2m_set_mem_access HVMOP_altp2m_change_gfn
     altp2mhvm_op
+# DMOP
+    dm
 }
 
 # Class event describes event channels.  Interdomain event channels have their